SEKOIA.IO Rules medium stable sigma

Microsoft Defender Antivirus Threat Detected

Detection of a Microsoft Defender Antivirus (MDAV) alert indicating the presence of potential malware

View Source

Detection Logic

selection:
  action.id:
    - "1006"
    - "1007"
    - "1008"
    - "1015"
    - "1116"
    - "1117"
    - "1118"
    - "1119"
    - "1125"
    - "1126"
  event.provider: Microsoft-Windows-Windows Defender
condition: selection

Field Validations

Loading…

Comments (0)

Loading comments...